A Free OSINT Lesson: The Simple Beauty of Aging
Information and data ages and seasons. Make sure you don't lose track of it.
I love the outdoors. I always have. My childhood was a culmination of fishing and camping, and—like many Canadians—I was pretty much raised outside in the woods.
Just play this in the background as you read this post. You’re fucking welcome.
There's pride in the fact that my 7-year-old can successfully build and start a bonfire at the cabin using only one match. He understands the concept, the proper approaches based on the temperature and weather, and the types of wood that burn hotter versus cooler.
We have a decent-sized woodshed, and he can wander in there and lift each log, knowing which one to start with to get the fire going quickly. It's in the weight. He understands the older logs are in front and the new ones are towards the back. Those new ones will season over time, eventually moving up to the front.
These incredibly tall jack pine trees surround our little cabin in the woods, and we've had to cut many down over the last several years, mainly thanks to climate change. We've had less snow, which means less water in the soil, and as the summer comes on faster and hotter, the trees are thirstier, and they become susceptible to these tiny little weevils that eat away at the inside of the trunk. It's left me with walls of cut logs stacked in rows near the woodshed, all waiting for me to stroll up in my red plaid shirt and axe (fuck that, I have a log splitter) and start splitting.
The thing is, you don't just cut the tree down, cut it into pieces, and then split the wood. There is time involved. This is a slow process.
After the whole logs are stacked, they sit for a couple of years, exposed to the wind and the sun. They wait.
There is a simple beauty to seasoning wood for a fire, and there is an OSINT lesson here
Want to chat? Hire us for an investigation, due diligence, or research project? Just slide into my DMs.
Information and data also seasons, much like firewood. As I work on various investigations, some for very short periods and some that can take years, all that open-source intelligence sits exposed to the elements. It's heavy when you cut a tree down and begin hauling that wood to pile it up. Wait two years, and that same piece can lose nearly half its weight because all the water inside has evaporated. After you split it and stack it into the woodshed, by the time you burn it, it's incredibly light—it feels lighter than it should—because it's bone dry. You barely need any heat to make it burn. Time and open-air have a way of changing things.
We see the same thing with information. Just because that website or image was there two years ago doesn't mean it'll still be there now. The same goes for a username, a damning forum post, or even user data you can get via a subpoena where a social media company maintains a strict limited time period policy for log deletion (hah, a wood joke).
Like the moisture inside a recently cut-down tree, that shit will eventually disappear.
For example, we at Permanent Record have been working on an old case for a little while, a constant exercise that's close to becoming a meditation. For Kennedy, Justin and I, it has formed into this fibrous series of pathways in our brains that will, one day, kill us.
Ages ago, I found a Facebook comment related to the case. I can't get into details, but it led to someone who may have been connected. I logged it in my brain. I saved the URL as a bookmark, telling myself I would return to it later. I did have the good sense to write that person's name down in a notebook, which I later filed away for safekeeping.
A year or two later, when I could finally return to this section of the investigation, I was going through my old bookmarks and remembered, vaguely, about some Facebook comment that I wanted to check out.
"Oh, right!" I thought to myself.
So, I clicked the bookmarked link and was greeted by the "Content Unavailable" screen. The comment was gone. The entire thread was gone. Vanished.
I'm getting older, so like an old log, there is less moisture in my brain. I could hardly remember anything about it. The name was like "Hardy" or "Harvey?" Started with an H. "Henry?" And it was in a local group for this small town. What town was it? "Ridgemont?" "Ridgeside? Wait, was Ridge even in the name? Maybe it was "Richmond?"
"Well, shit."
It was like trying to use wet wood to light a fire. I was getting sparks but it just wouldn't catch.
Was this a proud OSINT moment for me? No. Did I feel like an idiot? Yes. Have I learned my lesson? Uh-huh.
I racked my brain for days, trying to remember. When I first saw it, that Facebook comment seemed unimportant. As the case seasoned, it became another clue. It needed time. The problem is that between this case, and working the countless and various other cases in between, my memory lost track of it.
The thousands of Coke Zeroes washed it away between then and now (it's how I measure time). I had assumed it was lost to the ether. I needed to move on.
It was a couple weeks later when I began to re-listen to some old recorded phone calls I made with other folks in the case. In one, this nice, sweet old lady gave me some names of people she knew I should contact regarding the investigation. I heard myself say something like, "Hold on, let me write this down…"
Then it hit me! I had a notebook!
But that was years ago… and where the fuck did I put it?
I ran to my filing cabinet and opened it. Now, here's a funny thing about me. I always buy the same notebook. I get these cheap hardcover black ring-coiled sketchbooks from the dollar store. Justin keeps telling me to buy the kind he uses. It's some fancy ass digital one that converts the notes into PDFs or something? Whatever. I'm a basic bitch.
(Quick aside, I was unsure if I was allowed to call myself a "basic bitch," so I asked my friend Micki, who is a self-proclaimed "basic bitch-adjacent” person. She said that it was fine. Due diligence. It matters.)
Long story short, the notebook is not there.
"Why is it not here? Where the fuck did I put it? Why wouldn't it be here?"
This is where I began to think about where else I'd store a notebook in my house. I literally roamed about looking for it. It wasn't on my bookshelf or my storage shelves holding my different microphones, audio recorders, and 70,000 feet of cables. Yeah. I keep every cable I ever get. I don't know why. It's a fetish.
If you ever need a HDMI, a RCA, or a CAT5—let me know…
But next to the storage shelf, in a clear plastic Rubbermaid bin, where I keep spare file folders and manila envelopes (you never know when you need a good manila envelope), I notice an old yellow notepad hiding underneath. And beneath that, a notebook.
"What?!"
I pull out the notebook. It has a red cover.
"Red? The fuck? Was I high when I bought this?"
I crack it open, and then I see the case name and just pages of notes from phone calls. As I flip through the pages, I see just various notes I made and then, on one page, I see…
"Facebook" followed by a sort of line that wanted to be an arrow, and "Harold Bennett." Just below, "Ridgeway, Ont."
"Oh, Thank God!"
I changed the name and the town for the purpose of this post. Sorry. Secrets.
So, with this lesson learned, I immediately changed my ways.
The first thing everyone in OSINT should do is use the Wayback Machine's browser extension. It's simple and free. Every website I visit for an investigation, every forum post I read, whatever my browser looks at that is related, I just click the extension to have Wayback Machine archive it. You can make little collections of your archive. Seriously. It's easy.
Kids who want to keep their own archives can use things like Archivebox. There are also some great git repos on the topic if you want to be super hardcore about it.
Second, I know it costs money, but get yourself Forensic OSINT or Hunchly. They have differences, and I won't get into that here, but using those tools and just having them scrape up the content you look at in your investigations is essential.
Third, take notes. Whether it's cheap dollar store notebooks, Google Docs, or some fancy tablet thing- just jot down basicnotes as you investigate day by day. It helps your brain. It also just gives you snapshots of your work, so when you go back, remembering becomes easier.
Fourth, timelines. I've said it before: Place your investigation in a timeline. Use a spreadsheet. Bullshit Hunting and Permanent Record Research are pretty much ride-or-die on timelines.
Some things take time. Oddly, when I was first brought into this investigation, I found a Facebook comment that the wood my son uses today to build fires at the cabin was still a tree. That tree fell. I cut it up. Stacked it. It has aged for two years. I then split it, and it's been seasoning in the woodshed until now.
But at that time, the data and information I assumed would last didn't. The logs became light. Water evaporated. The simple beauty of it all.